Description

A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the file /opils/staff/product.php. The manipulation of the argument Category leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-10-13T05:16:31.630Z",
  "pubdate": "2026-10-13T05:16:31.630Z",
  "executiveSummary": "A critical SQL injection vulnerability has been identified in the SourceCodester Performance Indicator System version 1.0.\nThe vulnerability resides within the /opils/staff/product.php file, specifically involving the improper sanitization of the 'Category' input argument.\nThis flaw allows remote, unauthenticated attackers to execute arbitrary SQL commands against the underlying database, potentially leading to unauthorized data access, modification, or complete database compromise.\nGiven that the exploit is publicly available, the risk of exploitation is high, and the system is susceptible to automated attack vectors.\nThe impact includes full confidentiality loss of the database contents, potential integrity compromise, and availability disruption depending on the database permissions and attacker intent.",
  "technicalDetails": "The vulnerability is a classic SQL injection (SQLi) condition stemming from the failure of the application to properly sanitize user-supplied input before incorporating it into a database query.\nThe affected component is /opils/staff/product.php, which processes the 'Category' HTTP parameter. When a request is made to this file, the application takes the value of 'Category' and embeds it directly into a SQL statement without sufficient validation or the use of parameterized queries/prepared statements.\nThe attack flow initiates with a remote attacker crafting a malicious HTTP GET or POST request targeting /opils/staff/product.php. By injecting SQL syntax characters (such as single quotes, semicolons, or commenting operators like '--') into the 'Category' argument, the attacker can break out of the intended query context.\nThis manipulation allows the attacker to execute arbitrary SQL queries, such as UNION-based attacks to extract data from other tables, error-based attacks to leak system information, or boolean-based blind injection techniques.\nBecause this vulnerability is triggered through remote network access, an attacker does not require local access or specific administrative privileges to initiate the exploit.\nThe persistence of the flaw is facilitated by the application's failure to employ modern database access patterns. By failing to use prepared statements with bound parameters, the application treats user input as executable code rather than data, allowing the database management system to execute the injected payload as part of the query logic.\nPost-exploitation impact is severe; successful execution allows an attacker to bypass authentication mechanisms, dump the contents of the database, or potentially perform administrative tasks if the database user account has elevated permissions on the host system."
}